EUVD-2025-60923

The Astra Security Suite – Firewall & Malware Scan plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient validation of remote URLs for zip downloads and an easily guessable key in all versions up to, and including, 0.2. This makes it possible for unauthenticated attacke...

CVE-2025-11521

CVE-2025-11521 : Astra Security Suite – Firewall & Malware Scan WordPress plugin (versions up to 0.2) is vulnerable to unauthenticated arbitrary file upload due to insufficient validation of remote URLs for zip downloads and a easily guessable key. The vulnerability can allow uploading arbitrary ...

CVE-2025-11521: Improper Authorization

The Astra Security Suite – Firewall & Malware Scan plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient validation of remote URLs for zip downloads and an easily guessable key in all versions up to, and including, 0.2. This makes it possible for unauthenticated attacke...

ALSA-2025:20838 Moderate: zziplib security update

The zziplib is a lightweight library to easily extract data from zip files. Security Fixes: zziplib: directory traversal in unzzipcat in the bins/unzzipcat-mem.c CVE-2018-17828 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related...

ROS-20251110-02

A vulnerability in the 7-Zip file archiver is related to incorrect symbolic link detection before file access. before accessing a file. Exploitation of the vulnerability could allow an attacker to execute arbitrary code if a user opens a specially crafted ZIP archive. provided the user opens a...

SUSE CVE-2025-62156

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Versions prior to 3.6.12 and versions 3.7.0 through 3.7.2 contain a Zip Slip path traversal vulnerability in artifact extraction. During artifact extraction the unpack/untar logic...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via improper symlink handling during the mounting process. An attacker can access and read arbitrary files from the virt-launcher pod's file system by creating a symbolic link within a PVC that points to sensitive...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via improper symlink handling during the mounting process. An attacker can access and read arbitrary files from the virt-launcher pod's file system by creating a symbolic link within a PVC that points to sensitive...

Directory Traversal

Overview AstrBot is a 易上手的多平台 LLM 聊天机器人及开发框架 Affected versions of this package are vulnerable to Directory Traversal via the encodeimagebs64 function. An attacker can access sensitive files by supplying a crafted file path in the request body. Details A Directory Traversal attack also known as pa...

Directory Traversal

Overview AstrBot is a 易上手的多平台 LLM 聊天机器人及开发框架 Affected versions of this package are vulnerable to Directory Traversal via the installpluginupload handler, which parses the filename from the request body and assigns it directly to filepath without validation. An attacker can write arbitrary files t...

archives 路径遍历漏洞

archives is a cross-platform, multi-format Go library from the French personal developer Matt Holt. A path traversal vulnerability exists in archives version 1.0.0, which stems from a lack of effective protection for specially crafted zip archives and could lead to remote code execution or file...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview mqtt is a Pure Ruby gem that implements the MQTT protocol, a lightweight protocol for publish/subscribe messaging. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip due to the lack of hostname validation in the connection process. An...

GO-2025-4023 Argo Workflow has a Zipslip Vulnerability in github.com/argoproj/argo-workflows

Argo Workflow has a Zipslip Vulnerability in github.com/argoproj/argo-workflows...

Directory Traversal

Overview dosage is an a comic strip downloader and archiver Affected versions of this package are vulnerable to Directory Traversal via the process of constructing target file names from remote comic sources, where the file extension is derived from the HTTP Content-Type header. An attacker can...

New HttpTroy Backdoor Poses as VPN Invoice in Targeted Cyberattack on South Korea

The North Korea-linked threat actor known as Kimsuky has distributed a previously undocumented backdoor codenamed HttpTroy as part of a likely spear-phishing attack targeting a single victim in South Korea. Gen Digital, which disclosed details of the activity, did not reveal any details on when t...

ABB PCM600

SUMMARY An update is available that resolves vulnerability in the product versions listed as affected in this advisory. An attacker who successfully exploited this vulnerability could insert and run arbitrary code in the system. 2. MITIGATING FACTORS Mitigating factors describe conditions and...

Directory Traversal

Overview mci-py is a Python adapter for MCI Affected versions of this package are vulnerable to Directory Traversal via the FileExecutor.execute and CLIExecutor.execute functions. An attacker can read, write, or execute files outside of the intended directory Details A Directory Traversal attack...

Directory Traversal

Overview letta is a Create LLM agents with long-term memory and custom tools Affected versions of this package are vulnerable to Directory Traversal via insufficient sanitization in the file upload functionality. An attacker can upload and overwrite files outside the intended directory by providi...

Directory Traversal

Overview InvokeAI is an An implementation of Stable Diffusion which provides various new features and options to aid the image generation process Affected versions of this package are vulnerable to Directory Traversal via the isvalidpath method. An attacker can download arbitrary files via the...

OESA-2025-2578 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...